Extracted

• • Target

    ASA_Cheats v9.9.8.exe

  • Size

    9.8MB

  • MD5

    eb4a83f674cbbc9dff30ce9c96194c3e

  • SHA1

    579de894b65fbbd1953ed72f9c068bbd8e86f10f

  • SHA256

    ae991565c4df9763e5a451a8b9392d9519c638a9dba90a41f30393b7b400296c

  • SHA512

    de03bfd977f7649244c7a03fd92a8214ee718a9e40caa65e12be908bc0b3046585f33f955d9a10e4220f0945b327ff3dd507ccb9e21620047af675d24a07e35f

  • SSDEEP

    196608:vBOBTJawpAFnjE74PEuPscgzAAsB+dJSOO/sgEztL5BruyMKSjOpzkKJrsIaYV5S:5OBTJaEAy74PVPsczMdJSJs5VpSCpzkF

  Score

  10^/10

  orcusfabioluxdiscoveryratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4